kosmos/husk-milter
8
0
Fork 0
Code Issues Packages Activity

Add test framework to test

Browse Source 
- Mail encryption (when expected)
- Introducer listing, adding and removing
- Locals listing, adding and removing
This commit is contained in:
Malte Meiboom
2026-05-20 14:27:28 +02:00
parent aed368e90d
commit 1f8d7e9a3f
19 changed files with 303 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitlab-ci.yml
+1 -2
View File
@@ -11,5 +11,4 @@ e2e-test-job:
stage: test
image: localhost:5000/mta:latest
script:
- bash /usr/bin/prepare.sh
- cd e2e-tests && bash runner.sh
- bash /usr/bin/prepare.sh && bash /opt/husk/mapped/e2e-tests/runner.sh
docker/MTAContainerFile
+4 -1
View File
@@ -52,10 +52,13 @@ RUN apt-get update -yqq && \
openssh-client \
sudo \
postfix \
postfix-pcre \
rsyslog \
postgresql \
openssl \
sq
sq \
bind9-host \
inotify-tools
RUN adduser --shell /bin/bash --disabled-password --gecos "" hockeypuck
docker/mta_provision/etc/postfix/main.cf
+2 -2
View File
@@ -41,9 +41,9 @@ myhostname = example.com
myorigin = example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = $myhostname, localhost.localdomain, localhost
mydestination = $myhostname, localhost.localdomain, localhost, example.com, example.org
#relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 0.0.0.0/0
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
docker/mta_provision/opt/husk/config.toml
+21 -1
View File
@@ -4,4 +4,24 @@ sequoia_home = "/tmp/sq_home"
logfile_config = "./log4rs.yml"
keyservers = [ "hkps://example.com" ]
keyservers = [ "hkp://example.com" ]
[logging.appenders.console]
kind = "console"
[logging.appenders.console.encoder]
pattern = "{d(%Y-%m-%d %H:%M:%S)(local)} {h({l})} [{t}] {m}{n}"
[logging.appenders.file]
kind = "file"
path = "/tmp/husk.log"
[logging.appenders.file.encoder]
pattern = "{d(%Y-%m-%d %H:%M:%S)(local)} {h({l})} [{t}] {m}{n}"
[logging.root]
level = "debug"
appenders = ["file"]
[logging.loggers."husk"]
level = "debug"
docker/mta_provision/usr/bin/gen_hockeypuck_conf.sh
+1 -1
View File
@@ -35,7 +35,7 @@ webroot="/var/www/"
bind="$IP:11371"
[hockeypuck.hkps]
bind="$IP:443"
bind="$IP:4443"
logRequestDetails=false
cert="$CERTS/$DOMAIN.crt"
key="$CERTS/$DOMAIN.key"
docker/mta_provision/usr/bin/gen_sq_home.sh
+2 -3
View File
@@ -24,8 +24,8 @@ sq key export --cert $ALICE_FPR > $TMP/alice_sk.pgp
sq key export --cert $CA_FPR > $TMP/ca_sk.pgp
# only certs
sq cert export --cert $BOB_FPR > $TMP/bob_pk.pgp
sq network keyserver publish --server hkps://example.com --cert $CAROL_FPR
sq network keyserver publish --server hkps://example.com --cert $DAVE_FPR
sq network keyserver publish --server hkp://example.com --cert $CAROL_FPR
sq network keyserver publish --server hkp://example.com --cert $DAVE_FPR
# create store
export SEQUOIA_HOME=$SEQUOIA_TARGET
@@ -41,4 +41,3 @@ sq pki link authorize --unconstrained --cert $CA_FPR --all --domain example.com
# bob@example.com has a local cert, which is certified by ca@example.com
# carol@example.com is published on a keyserver and certified by ca@example.com
# dave@example.com is published on a keyserver but uncertified
docker/mta_provision/usr/bin/prepare.sh
+20 -8
View File
@@ -3,29 +3,32 @@
BRANCH=$1
## create domain
echo "127.0.0.1 " $(hostname) > /etc/hosts
echo "127.0.0.1 " $(hostname) >> /etc/hosts
echo "127.0.0.2 example.com" >> /etc/hosts
echo "127.0.0.3 example.org" >> /etc/hosts
## build milter
if [ -f /opt/husk/mapped/Cargo.toml ] ; then
HUSK_BIN=/opt/husk/mapped/target/release/husk
else
HUSK_BIN=/opt/husk/mapped/target/debug/husk
HUSK_DIR=/opt/husk/mapped/
else
cd /opt/husk
git clone https://gitlab.com/husk-project/husk-milter.git
cd husk-milter
if [ "$BRANCH" != "" ] ; then
git checkout $BRANCH
fi
cargo build --release
cargo build
HUSK_BIN=/opt/husk/husk-milter/target/release/husk
HUSK_BIN=/opt/husk/husk-milter/target/debug/husk
HUSK_DIR=/opt/husk/husk-milter/
fi
## start rsyslogd
/usr/sbin/rsyslogd -n -iNONE &
## start postfix
sudo postfix start
sudo postfix start
## start and prepare postgres
DOMAINS="example.com"
@@ -52,5 +55,14 @@ done
bash /usr/bin/gen_sq_home.sh
## start milter
cd /opt/husk
$HUSK_BIN config.toml &
cd $HUSK_DIR/config
$HUSK_BIN daemon start --config config.toml &
## extract SEQUOIA_HOME from the configuration
SEQUOIA_HOME=$(grep "sequoia_home" config.toml | cut -d '=' -f 2 | tr -d ' ')
cat << EO_ENV > /tmp/env.sh
export HUSK_BIN=$HUSK_BIN
export HUSK_DIR=$HUSK_DIR
export SEQUOIA_HOME=$SEQUOIA_HOME
EO_ENV
docker/mta_provision/usr/bin/test_1.sh
+5 -4
View File
@@ -1,19 +1,20 @@
#!/usr/bin/bash
echo "test message" | sendmail -t root@example.com
adduser --shell /bin/bash --disabled-password --gecos "" mtatest
echo "test message" | sendmail -t mtatest@example.com
sleep 1
## simple test if mail passes
if [ -f /var/mail/root ] ; then
if [ -f /var/mail/mtatest ] ; then
echo "success"
rm /var/mail/root
rm /var/mail/mtatest
else
echo "failure"
exit 1
fi
## test encryption
## bob@example.com has an authenticated certificate in
## bob@example.com has an authenticated certificate in
## the cert store
echo "test message" | sendmail -t bob@example.com
sleep 1
e2e-tests/common.sh
+66
View File
@@ -0,0 +1,66 @@
#!/usr/bin/bash
# create a unix (shell) user
create_unix_user() { # name
adduser --quiet --shell /bin/bash --disabled-password --gecos "" $1 > /dev/null 2>&1
}
# delete a unix user, plus remove $HOME and mails
delete_unix_user() { # name
deluser --remove-home $1
}
# send a mail and wait for delivery
send_test_mail() { # email_address
echo "test mail" | sendmail $1
inotifywait -qq -t 3 -e close_write /var/mail
}
# test header
test_header() { # text
echo "##############################################"
echo $1
echo "Workdir: $WORKDIR"
echo "##############################################"
}
# Generate a key outside the cert store. The key will not be
# authenticated.
gen_key() { # email
FILE=$(echo $1 | cut -f 1 -d '@')
FPR=$(sq key generate --home none --shared-key --without-password \
--email $1 \
--output $WORKDIR/${FILE}_sk.pgp \
--rev-cert $WORKDIR/${FILE}.rev |& grep "Fingerprint:" | cut -d ':' -f 2)
echo $FPR
}
expect_mail() { # unix_user mode
if [ -f /var/mail/$1 ] ; then
case $2 in
encrypted)
if grep -q "BEGIN PGP MESSAGE" /var/mail/$1 ; then
R=0
else
echo "expected encrypted mail for $1" >&2
R=1
fi
;;
unencrypted)
if grep -q "BEGIN PGP MESSAGE" /var/mail/$1 ; then
echo "expected unencrypted mail for $1" >&2
R=1
else
R=0
fi
;;
delivered)
R=0
;;
esac
else
echo "no mail for $1" >&2
R=1
fi
echo $R
}
e2e-tests/local_run.sh
+3 -3
View File
@@ -1,10 +1,10 @@
#!/usr/bin/bash
cargo build --release
cargo build
docker run -ti \
--rm \
--mount type=bind,src=$(pwd),dst=/opt/husk/mapped/ \
localhost/mta \
bash -c "/usr/bin/prepare.sh && bash /opt/husk/mapped/e2e-tests/runner.sh"
localhost/mta:latest \
bash -c "/usr/bin/prepare.sh && bash /opt/husk/mapped/e2e-tests/runner.sh && bash -i"
e2e-tests/runner.sh
+14 -10
View File
@@ -1,21 +1,25 @@
#!/usr/bin/bash
. /tmp/env.sh
echo "bin:" $HUSK_BIN
echo "home:" $SEQUOIA_HOME
cd $(dirname $0)
for TEST in ./tests/* ; do
# create a new WORKDIR
export WORKDIR=$(mktemp -d)
if bash $TEST ; then
echo "success"
echo "SUCCESS"
else
echo "failure"
# post mortem
echo "ls -l /var/mail"
ls -l /var/mail
echo "mailq"
mailq
echo "host example.com"
host example.com
echo "FAILURE"
# post mortem, leave WORKDIR intact for inspection
cat /tmp/husk.log
exit 1
fi
# remove WORKDIR
rm -rf $WORKDIR
done
e2e-tests/tests/10_basic.sh
+7 -10
View File
@@ -1,18 +1,15 @@
#!/usr/bin/bash
echo "Basic: Test if MTA is working"
# source some functions
. common.sh
adduser --shell /bin/bash --disabled-password --gecos "" mtatest
echo "test mail" | sendmail mtatest@example.com
test_header "Basic: Test if MTA is working"
sleep 1
create_unix_user mtatest
send_test_mail mtatest@example.com
if [ -f /var/mail/mtatest ] ; then
RESULT_CODE=0
else
RESULT_CODE=1
fi
RESULT_CODE=$(expect_mail mtatest delivered)
deluser --remove-home mtatest
delete_unix_user mtatest
exit $RESULT_CODE
e2e-tests/tests/20_simple_encrypt.sh
+8 -17
View File
@@ -1,25 +1,16 @@
#!/usr/bin/bash
echo "Simple: Test encryption for available certificate"
# source some functions
. common.sh
test_header "Simple: Test encryption for available certificate"
# There is an authenticated certificate for bob in the cert store
adduser --shell /bin/bash --disabled-password --gecos "" bob
echo "test mail" | sendmail bob@example.com
create_unix_user bob
send_test_mail bob@example.com
sleep 1
RESULT_CODE=$(expect_mail bob encrypted)
if [ -f /var/mail/bob ] ; then
if grep -q "BEGIN PGP MESSAGE" /var/mail/bob ; then
RESULT_CODE=0
else
echo "no encryption detected"
RESULT_CODE=1
fi
else
echo "no mail detected"
RESULT_CODE=1
fi
deluser --remove-home bob
delete_unix_user bob
exit $RESULT_CODE
e2e-tests/tests/21_simple_not_encrypt.sh
+8 -17
View File
@@ -1,25 +1,16 @@
#!/usr/bin/bash
echo "Simple: Test encryption for unavailable certificate"
# source some functions
. common.sh
test_header "Simple: Test encryption for unavailable certificate"
# There is no authenticated certificate for alice in the cert store
adduser --shell /bin/bash --disabled-password --gecos "" alice
echo "test mail" | sendmail alice@example.com
create_unix_user alice
send_test_mail alice@example.com
sleep 1
RESULT_CODE=$(expect_mail alice unencrypted)
if [ -f /var/mail/alice ] ; then
if grep -q "BEGIN PGP MESSAGE" /var/mail/alice ; then
echo "encryption detected - that is wrong"
RESULT_CODE=1
else
RESULT_CODE=0
fi
else
echo "no mail detected"
RESULT_CODE=1
fi
deluser --remove-home alice
delete_unix_user alice
exit $RESULT_CODE
e2e-tests/tests/30_fetch.sh
+8 -17
View File
@@ -1,26 +1,17 @@
#!/usr/bin/bash
echo "Test encryption for certificate an a keyserver"
# source some functions
. common.sh
test_header "Test encryption for certificate an a keyserver"
# There is a certificate for carol on the keyserver
# it's certified by an introducer
adduser --shell /bin/bash --disabled-password --gecos "" carol
echo "test mail" | sendmail carol@example.com
create_unix_user carol
send_test_mail carol@example.com
sleep 1
RESULT_CODE=$(expect_mail carol encrypted)
if [ -f /var/mail/carol ] ; then
if grep -q "BEGIN PGP MESSAGE" /var/mail/carol ; then
RESULT_CODE=0
else
echo "no encryption detected"
RESULT_CODE=1
fi
else
echo "no mail detected"
RESULT_CODE=1
fi
deluser --remove-home carol
delete_unix_user carol
exit $RESULT_CODE
e2e-tests/tests/40_introducer_create.sh
+41
View File
@@ -0,0 +1,41 @@
#!/usr/bin/bash
# source some functions
. common.sh
test_header "Add introducer"
ELLEN_FPR=$(sq key generate --shared-key --without-password --name "Ellen" --email "ellen@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
cd $HUSK_DIR
$HUSK_BIN introducer add --cert $ELLEN_FPR --domains "example.org" --config config/config.toml
$HUSK_BIN introducer list --config config/config.toml
create_unix_user fred
FRED_FPR=$(sq key generate --shared-key --without-password --name "Fred" --email "fred@example.org" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
sleep 1
sq pki link retract --cert $FRED_FPR --all
sq pki vouch add --certifier $ELLEN_FPR --cert $FRED_FPR --email "fred@example.org"
send_test_mail fred@example.org
RESULT_CODE=$(expect_mail fred encrypted)
if [ "$RESULT_CODE" == "1" ] ; then
exit 1
fi
test_header "Remove introducer"
$HUSK_BIN introducer remove --cert $ELLEN_FPR --config config/config.toml
$HUSK_BIN introducer list --config config/config.toml
rm /var/mail/fred
send_test_mail fred@example.org
RESULT_CODE=$(expect_mail fred unencrypted)
delete_unix_user fred
exit $RESULT_CODE
e2e-tests/tests/41_introducer_load.sh
+19
View File
@@ -0,0 +1,19 @@
#!/usr/bin/bash
# source some functions
. common.sh
export SEQUOIA_HOME=$(mktemp -d)
test_header "Import introducer from file"
# create ellen
ELLEN_FPR=$(sq key generate --shared-key --without-password --name "Ellen" --email "ellen@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
sq cert export --cert $ELLEN_FPR > /tmp/ellen_pk.pgp
cd $HUSK_DIR
$HUSK_BIN introducer add --cert-file /tmp/ellen_pk.pgp --domains example.org --config config/config.toml
LIST=$($HUSK_BIN introducer list --config config/config.toml)
echo $LIST | grep -q 'ellen@example.com'
e2e-tests/tests/50_locals.sh
+11
View File
@@ -0,0 +1,11 @@
#!/usr/bin/bash
# source some functions
. common.sh
test_header "List locals"
GINA_FPR=$(sq key generate --shared-key --without-password --name "Gina" --email "gina@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
cd $HUSK_DIR
$HUSK_BIN locals list --config config/config.toml | grep $GINA_FPR
e2e-tests/tests/51_add_locals.sh
+62
View File
@@ -0,0 +1,62 @@
#!/usr/bin/bash
# source some functions
. common.sh
test_header "Add locals"
sq key generate --shared-key --without-password --email 'hubert@example.com' --output /tmp/hubert.pgp --rev-cert /tmp/hubert_rev.pgp
cd $HUSK_DIR
$HUSK_BIN locals add --cert-file /tmp/hubert.pgp --config config/config.toml
if ! $HUSK_BIN locals list --config config/config.toml | grep -q "hubert@example.com" ; then
echo "adding failed"
exit 1
fi
# send a mail, husk should encrypt it
echo "send mail to hubert@example.com"
create_unix_user hubert
send_test_mail hubert@example.com
if [ -f /var/mail/hubert ] ; then
if grep -q "BEGIN PGP MESSAGE" /var/mail/hubert ; then
RESULT_CODE=0
else
echo "no encryption detected"
delete_unix_user hubert
exit 1
fi
# remove mail
rm /var/mail/hubert
else
echo "no mail detected"
delete_unix_user hubert
exit 1
fi
sleep 1
# remove hubert as local
HUBERT_FPR=$(sq cert list --cert-email hubert@example.com 2>/dev/null | head -n 1 | cut -d ' ' -f 3)
$HUSK_BIN locals remove --cert $HUBERT_FPR --config config/config.toml
echo "send mail to hubert@example.com"
send_test_mail hubert@example.com
if [ -f /var/mail/hubert ] ; then
if grep -q "BEGIN PGP MESSAGE" /var/mail/hubert ; then
echo "encryption detected where there should be none"
RESULT_CODE=1
else
RESULT_CODE=0
fi
else
echo "no mail detected"
RESULT_CODE=1
fi
delete_unix_user hubert
exit $RESULT_CODE